registry / Remote code execution / react-next-dom
react-next-dom
This document describes the management of vulnerabilities for the project and all modules within the organization.
This report shows the evidence for react-next-dom@17.2.8. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection confirms concrete malicious behavior: hidden detached execution of remotely fetched code unrelated to a React/DOM package or normal logger middleware. Lack of install hooks limits trigger scope but does not mitigate the runtime RCE loader.
Static reason
One or more suspicious static signals were detected.
Trigger
User/application calls the default exported middleware from index.js.
Impact
Arbitrary remote JavaScript can run in the consumer environment with Node require access; final payload behavior is controlled off-package.
Mechanism
detached child_process plus remote dynamic code execution
Attack narrative
A consumer importing the package and invoking its middleware causes index.js to spawn a detached Node process running lib/caller.js. That script requests https://jsonkeeper.com/b/D3GLF with a secret-like header, reads data.cookie from the response, compiles it with Function.constructor, and invokes it with require. This gives the remote payload arbitrary Node module access outside the audited package source.
AI rationale
Source inspection confirms concrete malicious behavior: hidden detached execution of remotely fetched code unrelated to a React/DOM package or normal logger middleware. Lack of install hooks limits trigger scope but does not mitigate the runtime RCE loader.
Evidence
package.jsonindex.jslib/caller.js
Network endpoints2
jsonkeeper.com/b/D3GLFjsonspack.com/issues
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- lib/caller.js fetches remote data from https://jsonkeeper.com/b/D3GLF.
- lib/caller.js executes fetched data.cookie via new Function.constructor("require", s).
- index.js runs lib/caller.js in a detached ignored child process when exported middleware is invoked.
- lib/caller.js retries the remote execution up to five times and suppresses errors.
- Package presents logger-like files/docs while package name is react-next-dom, indicating likely masquerading.
Evidence against
- package.json has no install/preinstall/postinstall lifecycle scripts.
- Remote execution is not triggered merely by npm install or by requiring index.js; it triggers on middleware invocation.
- No direct credential or filesystem harvesting is visible in packaged source before the remote payload executes.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
1 flagged · loading sourcedocs/transports.mdView file
550patternName = generic_password
severity = medium
line = 550
matchedText = password...rd',
Medium
Findings
1 High3 Medium3 Low
HighEval
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndocs/transports.md
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to react-next-dom@17.2.8.
The versions list below shows the verdict for each recorded version.
- Avoid installing react-next-dom@17.2.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.